631946 - SVG DOM lists should limit the number of items to the number they can index

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jonathan Watt [:jwatt]]

Followup from bug 631939. SVG DOM lists should limit the number of items to the number of items that they can index.

Comment 1

[Jonathan Watt [:jwatt]]

Attachment: patch

Comment 2

[Jonathan Watt [:jwatt]]

Attachment: patch for checkin

Comment 3

[Jonathan Watt [:jwatt]]

This patch depends on the patch in bug 631939 (also ready to push), so land import that one first.

Comment 4

[Jonathan Watt [:jwatt]]

Pushed to try: http://tbpl.mozilla.org/?tree=MozillaTry&rev=a360688c9ea0

Comment 5

[Jonathan Watt [:jwatt]]

Comment on attachment 510194 [details] [diff] [review]
patch for checkin

>@@ -170,16 +170,21 @@ DOMSVGPathSegList::InternalListWillChang
>     // Only now may we truncate mItems
>     mItems.SetLength(newLength);
> 
>   } else if (dataIndex < dataLength) {
>     // aNewValue has more items than our previous internal counterpart
> 
>     // Sync mItems:
>     while (dataIndex < dataLength) {
>+      if (mItems.Length() - 1 > DOMSVGPathSeg::MaxListIndex()) {
>+        // It's safe to get out of sync with our internal list as long as we
>+        // have FEWER items than it does.
>+        return;
>+      }

This caused the orange on the try push, because mItems.Length() returns a unsigned value, and so subtracting 1 causes us to return here, which gets us out of sync.

Comment 6

[Jonathan Watt [:jwatt]]

Attachment: patch for checkin

Comment 7

[Jonathan Watt [:jwatt]]

Pushed to try with fix: http://tbpl.mozilla.org/?tree=MozillaTry&rev=bd7c865af7fa

Comment 8

[Daniel Holbert [:dholbert]]

Comment 7 passed try-server (after some RelEng woes were resolved in bug 632211).
  --> Adding checkin-needed flag, at jwatt's request.
(For anyone checking this in, note whiteboard contents: patch from bug 631939 must come first.)

Comment 9

[Jacek Caban]

http://hg.mozilla.org/mozilla-central/rev/5268e56c2b26